Robust risk management is the foundation of any successful data privacy and protection program: Rachit Shukla, CISO and Associate Director, Information Security, HIPPO Stores

When talking about data protection, privacy and security are the two pillars of the overall Data Protection Program. Data privacy is not just about the proper handling of data; it is also about the public’s expectation of privacy. These two cannot be expressed in silos or without complementing each other.

For the retail business in particular, the customer is the pivotal point of everything that we do—our products, our solutions, our tech. In such a context, it becomes essential that we do the right thing by not only securing the customer data but also ensuring its secrecy.

We must be thankful for global regulations such as GDPR, which help organisations handle customer data in the desired way. On the contrary talking about Indian companies, especially in retail, less has been done than said. When we discuss global privacy regulations, we are aware that data protection laws seem to be a possibility in the future, but these privacy regulations, including data protection regulations, are yet to become law. So when this thing comes into effect, it won’t be an easy thing to deal with.

It will bring obligations in terms of; data collection, data localisation, and encryption. Third-party access, and privacy regulations for the entities.

All these obligations have compelled organsations to take actions that arise out of a certain set of actions:

-Obligations transpired into actions
-Data Availability
.Data availability-less RTO
.No data loss; affordability
.A new backup strategy was formulated.

– Data Anonymisation
.Tech stacks must be capable of handling data anonymisation
.No unnecessary identification of individuals in stored data

– DLP
.Organisational IP and customer data mustn’t be disclosed to unauthorised parties
.Identification of insider threat agents

-Security operation
.Bird’s eye view and micro-level visibility of the tech systems and emerging threats
.Privacy by design

– Continuous Incident Management
.Early indicators of threat
.Post-incident response mechanism
.Cognizant approach to managing breaches

In today’s connected world, there is no shortage of technology solutions at our disposal, and there is also no dearth of technological solutions, but the approach is to carve out what suits best the context of the organisation. Here, robust risk management is the foundation of any successful Data Protection and Privacy program. Any Information Protection Management System shall be as good as its underlying risk management framework.
Being aware of the responsibilities and obligations of being data controllers and data processors and considering the most vital data sets to be protected is the only way, a good data protection strategy can be adopted.

Below listed are a few early indicators of cyber-attacks in 2023, organisations must protect themselves from:

-State-sponsored attacks
.Increased social engineering attacks
.Tech infra disruption
.Orchestrated ransomware attacks
-Credential-based attacks
.Have been and will rise
.Lack of user awareness of security responsibilities
.Use of weak passwords/sharing
.2FA-A mandate
-Hybrid working emerging cyber threats
.VPN and remote access shall be targeted.
.Users continue to be the weak point.
.2FA spamming

-Web application asset management
.Cloud resources-difficult to protect if there is no knowledge if they exist.
.Reduce attack exposure through proper asset inventory management.
Organisations embracing cyber security should be quick to turn around, and quick incident responses are the key to cyber survival in 2023.

Security and privacy non-negotiable in digital transformation
Organisations must not forget that the customer data processed is only for custodial purposes and is borrowed from customers with their explicit consent.
Businesses cannot operate without processing personal data in some way; the difference is how they manage and secure the data through being compliant, accountable for the data, adhering to security and privacy policies, and investing in security initiatives.

Having a robust and management-backed Data Security and Privacy program will only fuel their digital transformation to achieve competitive advantage-Improved Security and Controlled Privacy-🡪 Higher Quality of usable data-🡪 Customer Assurance–🡪 Improved Customer Experience-🡪 Greater investor appeal-🡪 Brand value